OPENSSL-PASSPHRASE-OPTIONS(1SSL)

📦
version 4.0.3 · 13 versions
, in ubuntu stonking

💖 OPENSSL-PASSPHRASE-OPTIONS(1SSL) 💖

okay bestie, this is the manpage for openssl-passphrase-options from the OpenSSL fam (section 1SSL) — it's the whole lore on how you hand a password to an openssl command without it being A Whole Thing. sit down, hydrate, let's go 🌸

✨ NAME ✨

openssl-passphrase-options — Pass phrase options

🦋 SYNOPSIS 🦋

openssl command [ options ... ] [ parameters ... ]

🌈 DESCRIPTION 🌈

so like, a bunch of OpenSSL commands take password arguments, and usually they're -passin for the input password and -passout for the output password. these give you a menu of ways to source that password — pick your fighter. both options take exactly one argument, and the format of that argument is the whole thing described down below, no cap.

and if you don't give a password argument but one is required? the command will just prompt you for it. typically that means it reads from the current terminal with echoing turned off, so nobody's shoulder-surfing your keystrokes 👀

ngl, character encoding may be relevant here — go peek at passphrase-encoding(7) if that's your vibe.

🎀 OPTIONS 🎀

💅 Pass Phrase Option Arguments

pass phrase arguments can be formatted as follows, bestie. each one's got its own energy:

  • pass:password — the actual password is literally password, just sitting there in plain sight. and that's the problem — since the password is visible to utilities (like ps under Unix), this form should only be used where security is not important. yes, ps will snitch. it's giving exposed 🙈
  • env:var — grab the password from the environment variable var. 🍓 but heads up: since the environment of other processes is visible on certain platforms (e.g. ps under certain Unix OSes), this option should be used with caution. cautious queen behavior only 👑
  • file:pathname — reads the password from the specified file pathname, which can be a regular file, device, or named pipe. only the first line, up to the newline character, is read from the stream. one line and it's done, periodt.

and the cute part: if the same pathname argument is supplied to both -passin and -passout, the first line will be used for the input password, and the next line will be used for the output password. two lines, two jobs, love that for them 💖

  • fd:number — reads the password from the file descriptor number. super useful for sending data via a pipe, for example. same line handling as described for file: applies to passwords read from file descriptors.
💀 warning: fd: is not supported on Windows. not even a little bit.
  • stdin — reads the password from standard input. same line handling as described for file: applies to passwords read from standard input. classic, iconic, never misses ✨

Copyright 2000-2024 The OpenSSL Project Authors. All Rights Reserved.

Licensed under the Apache License 2.0 (the "License"). You may not use this file except in compliance with the License. You can obtain a copy in the file LICENSE in the source distribution or at <https://www.openssl.org/source/license.html>.

and that's the whole page, bestie 🫶 this was OpenSSL 4.0.3, dated 2026-09-29, manual page OPENSSL-PASSPHRASE-OPTIONS(1SSL) — kbye, go keep your passphrases secret 💜🧚

📦 where this page comes from